I'm guessing the damage numbers are higher because of a number of high-impact city-focused attacks. I live in Baltimore, where all of the city's systems were shut down for a few months over a ransomware attack asking for <100k. A similar attack occurred last year in Atlanta; wikipedia quotes a demand of 50k & Atlanta estimated around 10M in contractors for recovery.

https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_atta...